Add Azure Key Vault authentication secrets

[josh-uk]

Summary

• add UI-managed Microsoft device-code sign-in using the bundled Azure CLI, with no custom app registration or terminal step
• support Azure Key Vault references for authentication secret fields with just-in-time server-side resolution
• persist isolated Azure CLI state in Docker Compose and smoke-test amd64 and arm64 images
• update the authentication documentation, screenshots, security model, changelog, and package version for v1.1.0

Verification

• 102 unit tests with coverage thresholds passing
• 22 component tests
• 44 PostgreSQL integration tests
• 10 Playwright end-to-end tests including accessibility
• production Next.js build
• Docker runtime smoke: non-root UID, Azure CLI 2.88.0, writable mode-700 Azure config, Sharp, and health tooling
• npm audit: 0 vulnerabilities
• independent security and release reviews: no remaining blockers

Closes #33